Satellite Hacking for Fun & 

Profit! 



Adam Laurie 
adam@algroup. co. uk 

http://rfidiot.org 



Who Am I? 

Open Source developer / researcher 

- Bluetooth 

- RFID 

- Full Disclosure / White Hat! 
Freelance research / training / lecturing 



Why Now? 

Jim Geovedi & Raditya Iryandi 

- Hacking a Bird in The Sky 

Old Skewl 

- Started doing this in late 90's. 

- So, err... why did it take so long to publish? 



Feed Hunting 



Look for 'interesting' satellite feeds 

- Scan all satellites 

- Scan all frequencies 

- Report on mailing lists / forums 
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Welcome to my Web site! 

Here you can find several links to websites in which I'm interested. 
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i-' Satellite-feed-forums 
Sat-Benelux 
Sat4fun 
Sat4AII 
Satfeeds.eu 
Feed Hunters Place 
Chitchat 
Sportfeeds 
Satellite Tracker (info 
uitzendsatellieten) 
Feedhuntplaza 
Screenshots Feedhuntplaza 
Satboard.nl 
Feedhuntplaza 
DXTV.de 
DX-tv 
King of Sat 
Feed-Frequency 
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BVD-sat 

Worlwide webcam and Webcam TV 

All digital sat-receivers 

Online Satelite Calculations 

Digi-televison 

Prog DVB 

DVB-Dream 

Flysat 

Lyngsat 

King of Sat 

Satelliet-link-pagina 

Satlinks-plaza 

Football and other Sport on the Sat. 1 

Football and other Sport on the Sat. 2 

Football and other Sport on the Sat. 3 

Football and other Sport on the Sat. 4 

Football Live. 5 
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SATELLITE TRACKER 

ALL INFORMATION ABOUT THE SATELLITES 



JULY 26TH, 2006 

TV Speltetje i^^^^^^^^^^^H 

CHANNEL 

Name: "RGS 2B" Provider: " Rosegarden" 
TRANSPONDER 

11185000, V, 8680000 QPSK 

Satellite: 0330 - Eurobird 2 

Signal Level:10% Quality:28% 
IDs 

NetwordID:l TransponderID:2 SID: 10 
PIDs 

Video=101 AudiO:102 - dut PCR=101 PMT:100 Teletext: 
DATE/TIME 

26-7-2006 11:26:54 (GMT +1) 

REPORTER: Snuffer 

Popularity: 6% 

Posted by Snuffer as E 33 Euntbinl 3 at 11:27 AM PDT 

No Comments >. 
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■ i 



^gj. Tor Disabled 



E 33 Eurobird 3 - M... 



| Starting Take Screen... 



Poking in the dark 



-> 


Applicatic 


ns Places 


System 


gMsr^a * ifts^c* 


•osso^a 








^■«mQQSP4 


Wed 


6 Feb, 


B:B5AM E&7 "C^ 


File 


Edit View History 


Boo km 


arks lools Help 






IIHIIFlllHIH 


















T 


y" :i i.--- 


$ 
























N _ 


* http:;>ww.satplazs 


.com/feedh 


jntplaza/inde> 


.php 








EH ►! lO'lsatallitB 


feed hunter dx 


























Co 


#e satellite feed h 


nterdx 


Q| |G Search -JH « © 


gG6 


- Hi Bookmarks- 


?-ch 


>ck 


- \AutoLink 'u .Fill -» Send to- S 


Q 


satellite 


» Q Settings- 


/. 


Slashdot 


News for nerds, st... 


Q Enigma Web Interface 


Dma-Ui 


G satellite feed hunter dx - Go. 


■ 


U 


=eedhunter Rini 








nfl- 








□ Li^ 




There must be a better way! 



Visualisation is your friend 

- Human Brain likes images 

• Recognise food 

• Recognise danger 

• Recognise friends 

• Recognise enemies 



Visual Representations 



Visual Representations 
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Visual Representations 
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Time travel - day 1 
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Time travel - day 2 
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That was then... 

Proprietary control systems 

- Undocumented 

• Reluctant manufacturers 

- Special hardware / interface converters 

• Motor Control 

• Signal Status 

- to RS232 

- Expensive receivers 



This is now... 

Open standards 

- DVB Cards 

- Embedded Linux Receivers 

• Dreambox 

- Tuxbox based 

- GPL source code 

- Cross compilers 

- Alternative firmware 

• http://www.i-have-a-dreambox.com 

- http://www.dream-multimedia-tv.de/ 



This is now. 

Web Interface 

- Select programming 

- Steer dish 

- Examine feed properties 



Web Interface 
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Service Name Data_01 


|M carling cup final 




Service Provider OpenMux IP Gateway 






Google carling cup final 


Settings- 
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' [j Enigma ... Q |Cl dvbsnoop p 


vpid rrrrrrrrh (-id) 


LsnhamH... Q Home | Carlin... - 




APID ffffffffh (-Id) 








PCRPID ffffffffh (-Id) 
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| Symbol Rate 27500 KSymbols/s 
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You've got to know how to grab it... 




Stream Info 

dvbsnoop - DVB and MPEG stream analyzer 

- "WireShark for DVB" 

- Access to raw data from DVB card 

- Decode known PIDs 

http://dvbsnoop.sourceforge.net 
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~> dvbsnoop -s signal -n 1 

4.48 -- http://dvbsnoop.sourceforge.net/ 



Transponder/Frequency signal strength statistics., 
max cycle count: 1 



cycle: 1 dtime: 0.001 s Sig: 56961 SNR : 62049 BER: UBLK: Stat: 0x7b [SIG LOCK ] 
root@dm7020:~> | 
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time: 0.001 s 


Sig: 56961 SNR: 62049 BER: UBLK: Stat: 0x7b [SIG LOCK ] 
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//dvbsnoop . sourceforge. net/ 
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PID-Scan. . . 








PID found: 


(0x0000) 


[SECTION 


Program Association Table (PAT)] 




PID found: 


1 (0X0001) 


[SECTION 


Conditional Access Table (CAT)] 




PID found: 


17 (0X0011) 


[SECTION 


Service Description Table (SDT) - other transport stream 




PID found: 


18 (0X0012) 


[SECTION 


Event Information Table (EIT) - actual transport stream, 


present/follc 


PID found: 


52 (0X0034) 


[SECTION 


User private] 




PID found: 


89 (0X0059) 


[SECTION 


ATSC reserved] 




PID found: 


96 (0X0060) 


[SECTION 


User private] 




PID found: 


192 (0X00C0) 


[SECTION 


DVB CA message section (EMM/ECM)] 




PID found: 


261 (0X0105) 


[SECTION 


Program Map Table (PMT)] 




PID found: 


262 (0X0106) 


[SECTION 


Program Map Table (PMT)] 




PID found: 


263 (0X0107) 


[SECTION 


Program Map Table (PMT)] 




PID found: 


264 (0X0108) 


[SECTION 


Program Map Table (PMT)] 




PID found: 


265 (0X0109) 


[SECTION 


Program Map Table (PMT)] 




PID found: 


266 (0x010a) 


[SECTION 


Program Map Table (PMT)] 




PID found: 


270 (0x010e) 


[SECTION 


Program Map Table (PMT)] 




PID found: 
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271 (0x010f) 


[SECTION 


Program Map Table (PMT)] 
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Help 

descriptorlength: 7 (0x07} 
countryavailabilityflag: 1 (0x01} 
reserved: 127 (0x7f} 

countrycode: GBR 

country_code: IRL 



DVB-DescriptorTag: 95 (0x5f} 
descriptor_l^rig"th : 4 (0x04} 
PrivateDataSpecifier: 2 (0x00000002} 



[= privatedataspecif ierde scrip tor] 
[= BskyB 1] 



DVB-DescriptorTag: 72 (0x48} [= servicedescriptor] 

descriptorlength: 18 (0x12} 

servicetype: 134 (0x86) [= User defined] 

serviceprovidernamelength: 5 (0x05} 

serviceprovidername : "BSkyB" -- Charset: Latin alphabet 

servicenamelength: 10 (0x0a} 

Servicename: "History HD" -- Charset: Latin alphabet 





DVB-DescriptorTag: 178 (0xb2} 


[= User def 
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descriptor length: 142 (0x8e} 
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0000 


Id 01 bl 7f 2a ab 


57 IS 


41 6a 


b8 


75 


55 63 


be 


e3 


*.W 


Aj . uUc. . 




0010 


fc 35 71 82 92 b2 


d5 c6 


Od 3b 


81 


55 


c6 Oa 


51 


86 


.5q.... 


.; .U. .0. 




0020 


b3 5b 93 ac 7f a5 


2a e3 


05 28 


f3 


15 


bf aa 


e3 


08 


.[....* 


.( 




0030 


Id 57 18 22 e9 23 


b5 d3 


aa e3 


08 


7d 


57 18 


52 


74 


W.".#. 


. . .}W.Rt 




0040 


6d 57 18 lb c9 2f 


85 8c 


93 e6 


da 


b8 


cQ eQ 


35 


5c 


mW . . . / ■ 


5\ 




0050 


60 49 aa e3 04 If 


d4 f7 


8d af 


80 


7f 


e5 66 


81 


b8 


% I 


f . . 




0060 


15 5c 60 a5 le ab 


8c 13 


aa e3 


08 


d2 


47 4d 


5c 


60 


V .... 


GMV 




0070 
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Help 



EventID: 21518 (0x540e} 

Start_time: 0xd4e417O0OO [= 2008-02-04 17:00:00 (UTC)] 
Duration: 0x0002500 [= 00:25:00 (UTC}] 
Runningstatus : 1 (OxOl) [= not running] 
FreeCAmode: (OxQO) [= unscrambled] 
Descriptorslooplength : 395 (0x18b) 

DVB-DescriptorTag: 77 (0x4d) [= shorteventdescriptor] 
descriptorlength : 154 (0x9a) 

IS0639_2_language_code : eng 
eventnamelength: 9 (0x09} 

event name: "<EM>MI High</EM>" -- Charset: Latin alphabet 
text_length: 140 (0x8c} 

textchar: "CBBC. Face Off: The team tackle a child crime-wave committed by allegedly well-beh 
are baffled when Lenny is arrested too. [5]" -- Charset: Latin alphabet 

DVB-DescriptorTag: 80 (0x50} [= componentdescriptor] 
descriptorlength: 11 (0x0b} 
reserved: 15 (GxOf) 
streamcontent : 15 (OxOf) 
componenttype: 5 (0x05} 

== Content&Component : (= user defined} 
componenttag: 255 (Oxff) 
I50639_language_code: 
component-description: " ETV 2" -- Charset: Latin alphabet 

DVB-DescriptorTag: 80 (0x50} [= componentdescriptor] 
descriptorlength : 11 (0x0b) 
reserved: 15 (OxOf) 
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Terminal Tabs Help 

Service name: "Retail Info" -- Charset: Latin alphabet 

Servicename: "SkyPoker.com" -- Charset: Latin alphabet 

Servicename : "Sky Vegas" -- Charset: Latin alphabet 

Servicename: "1429" -- Charset: Latin alphabet 

Servicename : "Crime" -- Charset: Latin alphabet 

Servicename : "PTV Global" -- Charset: Latin alphabet 

Servicename: "53118" -- Charset: Latin alphabet 

Servicename: "Pitch World " -- Charset: Latin alphabet 

Servicename: "DoveVision TV" -- Charset: Latin alphabet 

Servicename: "oMusic TV" -- Charset: Latin alphabet 

Servicename : "Pitch TV" -- Charset: Latin alphabet 

Servicename: "Babestar+" -- Charset: Latin alphabet 

Servicename : "Total Hits - UK" -- Charset: Latin alphabet 

Servicename: "Rock Anthems" -- Charset: Latin alphabet 

Servicename: "Drive" -- Charset: Latin alphabet 

Servicename: "The Alternative - UK" -- Charset: Latin alphabet 

Servicename: "Harder Than Hell" -- Charset: Latin alphabet 

Servicename : "6Qs" -- Charset: Latin alphabet 

Servicename: "70s" -- Charset: Latin alphabet 

Servicename: "DanceFloor Fillers" -- Charset: Latin alphabet 

Servicename : "Bass, Breaks & Beats" -- Charset: Latin alphabet 

Servicename : "Urban" -- Charset: Latin alphabet 

Servicename: "Classic R'n'B & Soul" -- Charset: Latin alphabet 

Servicename: "Reggae" -- Charset: Latin alphabet 

Servicename: "World Music" -- Charset: Latin alphabet 

Servicename : "Jazz Classics" -- Charset: Latin alphabet 

Servicename: "Cool Jazz" -- Charset: Latin alphabet 

Servicename: "Chillout" -- Charset: Latin alphabet 

Servicename: "Country" -- Charset: Latin alphabet 

Servicename: "Indie Classics" -- Charset: Latin alphabet 
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Sectionlength: 1513 (0x05e9) 
MACaddrbyte/DevicdID 6: 24 (0x18) 
MACaddrbyte/DevicelD 5: 127 (Gx7f) 
reserved_2: 3 (QxQ3) 
payloadscramblingcontrol: (0x00) 
addressscramblingcontrol : (0x00) 
LLCSNAPflag: (0x00) 
current nextindicator: 1 (0x01) 
Sectionnumber: (QxQQ) 
LastSectionnumber: (0x00) 
MACaddrbyte/DevicelD 4 
MACaddrbyte/DevicelD 3 
MACaddrbyte/DevicelD 2 
MACaddrbyte/DevicelD 1 
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unscrambled] 
unscrambled] 



[= valid now] 



64 (0x40) 
94 (0x5e) 

(0x00) 

1 (0x01) => MAC-Address/DevicelD: 01 : 00 : 5e :40 :7f : 18 



IPdatagrambytes : 

Version: 4 (0x04) 

IP header length: 5 (0x05) 

Type of service: (0x00) 

Total length: 1500 (0x05dc) 

Identification: 6070 (0xl7b6) 

Reserved: (QxQQ) 

DF: (0x00) 

MF: 1 (QxQl) 

Fragment offset: 185 (0x00b9) 

Time to live: 7 (0xQ7) 

Protocol: 17 (0x11) [= UDP] 

Header checksum: 61Q42 (Qxee72) 

Source address: Qa290e2e [= 10.41.14,46] 

Destination address: efc07fl8 [= 239.192.127.24] 
- -More- - 
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IPdatagrambytes : 

Version: 4 (0x04) 

IP header length: 5 (0x05) 

Type of service: (0x00) 

Total length: 1500 (0x05dc) 

Identification: 6070 (0xl7b6) 

Reserved: (OxOO) 

DF: (0x00) 

MF: 1 (0x01) 

Fragment offset: 185 (0x00b9) 

Time to live: 7 (0x07) 

Protocol: 17 (0x11) [= UDP] 

Header checksum: 61042 (0xee72) 

Source address: 0a290e2e [= 10.41,14.46] 

Destination address: efc07fl8 [= 239.192.127.24] 

UDPdatagram: 

Source port: 14299 (0x37db) 
Destination port: 59913 (0xea09) 
Length: 37795 (0x93a3) 
Checksum: 30137 (Qx75b9) 
Data 
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address scrambling control: (0x00) 
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LLC SNAP flag: 
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current next indicator: 1 (0x01) [= valid now] 
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IP datagram bytes: 
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Taking over the Dreambox 

Avoid programming 

- Analyse config files 

- Tools to tweak and update 

- Use existing Web Interface URLS 

- Use remote tools via IP 

• ssh / scp 

• dvbsnoop 

• tun/tap 
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ZAP: TV - Satellites 



Astra (19.2E) - new foun 
Astra (19.2E) - services 
Astra/Eurobird (28. 2E) 
Astra/Eurobird (28. 2E) 
Eutelsat W2 (16.0E) - n 
Eutelsat W2 (16.0E) - se 
Hotbird (13.0E) 
Hotbird (13.0E) 
current transponder 



AXN (a/P) 

AbsolutSexv-TV 

Alpengliihen TVX 

BABY FIRST 

BELSATTV 

BOOMERANG (a/P) 

BiB 

Biography Channel 

CANAL CLUB 

CANAL EVENEMENT 

CANAL+ FAMILY 

CARACOLTV 

CE SOIR 

CINE FX 

DISNEY MAGIC HD 

DISNEY PLAYHOUSE (P) 

DISNEY TOON (P) 

E. CLIPS (P) 

ECUAVISA INT 

ENCYCLOPEDIA 
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CONTROL: Satfinder 



Shutdown 



Remote Control 
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orbit 276 
orbit 277 
orbit 278 
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python (yay!) script 

- Grab URL 

- Read status from returned webpage 

- Create 3D model 



This is now... 
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3D model capabilities 



Point & Click 

- Steer to sat/freq 

- Decode DVB/Audio within model 

- Read Text / EPG 

- Pipe datagrams to Wireshark 



Demonstration 
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file Edit View Terminal Tabs Help 

root@dm7020:~> 
root(adm7020:~> 
root(adm7020:~> 
root(9dm7020:~> 
root(§dm7020:~> 
root<adm7020:~> 
root(adm7020:~> 
^root@dm7020:~> 
root(adm7020:~> 
root<adm7020:~> 
root<adm7020:~> 
root@dm7020:~> 
root<adm7020:~> 
root<adm7020:~> 
root@dm7020:~> 
root(adm7020:~> 

root@dm7020:~> dvbsnoop -s pidscan | grep datagram 

PID found: 5381 (0x1505) [SECTION: DSM-CC - private data section // DVB datagram] 
PID found: 5385 (0x1509) [SECTION: DSM-CC - private data section // DVB datagram] 
root<adm7020:~> dvbnet 1509 
pid 5385 (1509) 
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root(adm702©:~> dvbnet 1509 

pid 5385 (1509) 

device for pid 1509 created successfully 

root(adm7020:~> ifconfig -a 



Link encap: Ethernet HWaddr 00: Q9:34: BA: DA: DD 

BROADCAST NOARP MULTICAST MTU : 4096 Metric: 1 

RX packets:© errors:© dropped:© overruns:© frame:© 

TX packets:© errors:© dropped:© overruns:© carrier:© 

collisions:© txqueuelen: 1000 

RX bytes :0 (0.0 B) TX bytes:© (©.© B) 

Base address: 0x1509 



Link encap: Ethernet HWaddr 00:09:34: 14: BA:©7 
inet add r: 192. 168. 111. 67 Beast : 192. 168. 111.255 

UP BROADCAST RUNNING MULTICAST MTU: 1500 Metric 

RX packets: 1615 errors:© dropped:© overruns:© frame:© 

TX packets: 1834 errors:© dropped:© overruns:© carrier:© 

collisions:© txqueuelen: 1000 

RX bytes: 133285 (130.1 KiB) TX bytes:350560 (342.3 KiB) 

Interrupt:29 

lo Link encap: Local Loopback 

inet addr:127. 0.0.1 Mask: 255 . © .© .© 



Mask:255. 255. 255.0 
1 
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inet addr:127. 0.0.1 Mask: 255 . 0.0 .0 

UP LOOPBACK RUNNING MTU : 16436 Metric:l 

RX packets: 116 errors :0 dropped:© overruns:© frame:© 

TX packets:116 errors:0 dropped:© overruns:© carrier:© 

collisions:© txqueuelen:© 

RX bytes: 8446 (8.2 KiB) TX bytes: 8446 (8.2 KiB) 

] root(adm7020:~> ifconfig dvb0_0 up 
root(adm7020 :~> ifconfig 
dvb©_0 Link encap: Ethernet HWaddr 00:09:34: BA: DA: DD 

UP BROADCAST RUNNING NOARP MULTICAST MTU: 4096 Metric:! 
RX packets:1019 errors:© dropped:© overruns:© frame:© 
TX packets:© errors:0 dropped:© overruns:© carrier:© 
collisions:© txqueuelen: 1000 
RX bytes:363018 (354.5 KiB) 
Base address: 0x1509 



TX bytes:© (0.0 B) 



Link encap: Ethernet HWaddr 0Q: 09:34: 14: BA:07 

inet addr:192.168.111.67 Beast : 192 . 168 . 111. 255 Mask: 255. 255.255.0 

UP BROADCAST RUNNING MULTICAST MTU: 1500 Metric: 1 

RX packets: 1659 errors:© dropped:© overruns:© frame:0 

TX packets: 1860 errors:© dropped:© overruns:© carrier:© 

collisions:© txqueuelen: 1000 

RX bytes: 137103 (133.8 KiB) TX bytes: 355694 (347.3 KiB) 
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Equipment List 



Dreambox 7020 

- £250 ($350) 
Dish 

- £50 - £200 
Motor & Mount 

-£100 
Total = £550 ($785) 



Questions? 



http://rfidiot.org 
adam@algroup.co.uk 



